Online AntiVirus Rogueware Demo

The "Online AntiVirus Rogueware" uses a classic mix of visual trickery and social engineering to prey on innocent users. In the most general case, the user visits a malicious site which shows a popup that seems to resemble a live antivirus scan. This scanner supposedly scans through the user's hard drive and shows a red alert that the user has been infected with viruses and worms. In the final step of the attack this online AV instructs the victim to download a file from its site and use it to save his PC from the supposed infections. Once a gullible user downloads and installs this program he will probably become part of a botnet or just be phished.

In a personal experience, I've had my friend's laptop infected with such a trojan. The more interesting part was that he was running the latest AV, which was unable to detect this trojan. I spent around an hour using Process Explorer and a host of other tools to disinfect his machine - killing the trojan process, removing registry entires and deleting files. Netinfinity had created a nice primer on Malware analysis sometime back. Its a recommended watch!

Thanks to Panda Security for creating this video.

We hate these ADs as much as you do! Help us stay FREE and CLEAN by making a Generous Donation!

Vivek Ramachandran is a security evangelist and has been working in computer security related fields for the past 7 years. In 2007, Vivek spoke at world renowned conferences Defcon (WEP Cloaking Exposed) and Toorcon (The Caffe Latte Attack). The discovery of the Caffe Latte Attack was covered by CBS5 news, BBC online, Network World etc news agencies.In 2006, Vivek was announced as one of winners of the Microsoft Security Shootout contest held in India among 65,000 participants. He has also been a recipient of a Team Achievement at Cisco Systems for his work on 802.1x and Port Security modules on the Catalyst 6500 switches. Currently he spends all of his time maintaining Security- Freak.Net , SecurityTube.Net and is the co-founder of Axonize. Vivek, is a Bachelor in Electronics and Communications Engineering from the prestigious Indian Institute of Technology, Guwahati.You can contact him at vivek[at]securitytube.net